PT-2023-8474 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 Description: The issue is related to a lack of protection for service data in the FileProvider component of the macOS operating system. This may allow an attacker to disclose protected information. An app may be abl...

PT-2023-28159 · Zoho · Zoho Manageengine Admanager Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus versions prior to 7203 Description: The issue allows 2FA bypass for AuthToken generation in REST APIs. Recommendations: For versions prior to 7203, update to version 7203 or later to resolve the issue. As a...

CVE-2023-43644 Improper authentication in the SOCKS5 inbound in sing-box

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to...

PT-2023-28895 · Sing-Box · Sing-Box

Name of the Vulnerable Software and Affected Versions: Sing-box versions prior to 1.4.4 Sing-box versions prior to 1.5.0-rc.4 Description: The issue affects all SOCKS5 inbounds with user authentication in Sing-box, allowing an attacker to bypass authentication when specially crafted requests are...

PT-2023-31787 · Cloudflare · Simple Cloudflare Turnstile

Name of the Vulnerable Software and Affected Versions: The Simple Cloudflare Turnstile plugin for WordPress versions up to, and including, 1.23.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2023-29361 · WordPress · Gtranslate Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Translate WordPress with GTranslate WordPress plugin version 3.0.3 and earlier Description: The issue affects the Translate WordPress with GTranslate WordPress plugin, where it does not properly sanitise and escape some of its settings. This...

PT-2023-28775 · Icewarp · Icewarp Webclient

Name of the Vulnerable Software and Affected Versions: IceWarp WebClient version 10.3.5 Description: A Cross Site Scripting XSS issue in the Sign-In page allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter. This enables attackers to...

PT-2023-5441 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.12.0 Description: The issue is related to incorrect code generation management in Docker Desktop, allowing a remote attacker to execute arbitrary code via query parameters in the message-box route. This can...

AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

Summary In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. Impact If a program using the aes-gcm crate's decryptinplace APIs accesses the buffer after decryption failure, it will contain a...

PT-2023-27312 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 1.18.11 Description: DataEase is an open source data visualization and analysis tool. The program only uses the ImageIO.read method to determine whether the file is an image file or not. There is no whitelisting...

PT-2023-24932 · Unknown · Prestashop +1

Name of the Vulnerable Software and Affected Versions: Prestashop opartplannedpopup versions 1.4.11 and earlier Description: The issue allows remote attackers to run arbitrary SQL commands via the OpartPlannedPopupModuleFrontController::prepareHook method. This enables attackers to potentially...

PT-2023-26752 · Unknown · Ajino-Shiretoko Line

Name of the Vulnerable Software and Affected Versions: ajino-Shiretoko Line version 13.6.1 Description: An information leak allows attackers to obtain the channel access token and send crafted messages. Recommendations: For version 13.6.1, consider restricting access to the channel until a patch ...

PT-2023-28848 · Jenkins · Jenkins Build Failure Analyzer Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete Failure Causes. This issue arises because the plugin does not require POST requests for a...

Important: docker

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

PT-2023-28114 · Apache · Apache Flink Stateful Functions

Name of the Vulnerable Software and Affected Versions: Apache Flink Stateful Functions versions 3.1.0 through 3.2.0 Description: The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially...

PT-2023-27452 · Apple · Xcode +1

Name of the Vulnerable Software and Affected Versions: Xcode versions prior to 15 Description: The issue allows an app to potentially access App Store credentials. It was addressed by enabling hardened runtime. Recommendations: For versions prior to 15, update to Xcode 15 to resolve the issue. As...

PT-2023-28346 · Pow · Pow

Name of the Vulnerable Software and Affected Versions: Pow versions 1.0.14 through 1.0.33 Description: Pow is a authentication and user management solution for Phoenix and Plug-based apps. The use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being...

PT-2023-28385 · Withsecure · Withsecure Elements Endpoint Protection +5

Name of the Vulnerable Software and Affected Versions: WithSecure Client Security version 15 WithSecure Server Security version 15 WithSecure Email and Server Security version 15 WithSecure Elements Endpoint Protection versions 17 and later WithSecure Client Security for Mac version 15 WithSecure...

PT-2023-30751 · WordPress · File Manager Pro

Name of the Vulnerable Software and Affected Versions: File Manager Pro WordPress plugin versions prior to 1.8 Description: The issue arises from the improper checking of the CSRF nonce in the fs connector AJAX action. This allows attackers to perform highly privileged file system actions via CSR...

PT-2023-27990 · Xui-Xray · Xui-Xray

Name of the Vulnerable Software and Affected Versions: xui-xray version 1.8.3 Description: An issue in the software allows attackers to obtain sensitive information via a default password. Recommendations: For xui-xray version 1.8.3, change the default password to a unique and secure password to...